9 ms·

Infosec 101 for Activists

486 points by greenie_beans 2y ago

mastazi 2y ago
More resources on this topic: Activist or Protester? by EFF's Surveillance Self Defense https://ssd.eff.org/playlist/activist-or-protester https://ssd.eff.org/playlist/activist-or-protester The Protester's Guide to Smartphone Security by Privacy Guides https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/ https://www.privacyguides.org/articles/2025/01/23/activists-...
- frontalier 2y ago
  eff's a good source for most people on most occasions for everything else read material from anarchists. ex: https://opsec.riotmedicine.net/downloads#mobile-phone-security https://opsec.riotmedicine.net/downloads#mobile-phone-securi...
pstuart 2y ago
A bit of a tangent, but modern protests are subject to hijacking from agents provocateur and general shit stirrers -- it's been quite effective in delegitimizing public protests. It would be nice to find ways to counter that. Case in point: how BLM protests were turned into riots by antagonistic forces: https://abcnews.go.com/US/man-helped-ignite-george-floyd-riots-identified-white/story?id=72051536 https://abcnews.go.com/US/man-helped-ignite-george-floyd-rio...
- youainti 2y ago
  I think this was the whole point of the "self purification" process that Dr ML King Jr describes in his Letter from Birmingham Jail [0], where they had workshops on non-violence etc. [0] https://letterfromjail.com/ https://letterfromjail.com/
- blackeyeblitzar 2y ago
  [flagged]
  - RajT88 2y ago
    Blocking a highway is not an act of violence, it is a form of peaceful protest. Like a diner sit-in. You are free to correct your post to explain all the acts of violence you saw which justify the term "riot".
    - WaitWaitWha 2y ago
      There are multiple documented cases where emergency vehicles are blocked by "blocking a highway" as a "peaceful protest" that resulted in deaths. e.g., London (2022) - Mark Heap and Lisa Webber.
      - RajT88 2y ago
        That does not a riot make. It is still a peaceful protest, whether you like it or not, contingent on the definition of "peaceful" being the absence of violence. You do not have to like the outcome of a protest, but if it is not a violent one, you are expected here to describe it in accurate language. You are not doing that. To illustrate my point: your logic dictates that not pulling over for an emergency vehicle is tantamount to assault. It is not, and should never be in any rational society. Agree? Disagree?
        WaitWaitWha 2y ago
        I was responding to your note that it is peaceful, not that is or is not a riot. A gathering where someone dies because of the gathering it is no longer undisturbed by strife, turmoil, calm, and tranquil. It is no longer peaceful. > ... contingent on the definition of "peaceful" being the absence of violence. The breaking of peaceful to me is not absence of violence. It is no longer peaceful because force was used to stop the emergency vehicles. Force is one way to be no longer peaceful. In this context, when force is used it implies resistance from someone that was forced to do something they did not want to do (emergency vehicle did not want to stop). It is no longer peaceful; yet no direct "violence" was used.[1] I can fathom where your response comes and grasp your interpretation, but I disagree. [1] https://help.unhcr.org/iran/en/more-information/what-is-violence/ https://help.unhcr.org/iran/en/more-information/what-is-viol...
- protocolture 2y ago
  Interesting. I read an article stating the opposite. That to organise effective action on the ground, smart protesters were distracting the anti violence bleeding hearts while discussing and implementing more effective actions. In particular it was stated that part of those particular riots were a distraction to (successfully iirc) lure the cops away from the police station.
  - pstuart 2y ago
    > I read an article stating the opposite. Please share a link then. > That to organise effective action on the ground, smart protesters were distracting the anti violence bleeding hearts while discussing and implementing more effective actions. There's a lot to be unpacked there, but I'm not sure about what you think is "effective action" and why peaceful demonstrators are a bad thing. Here's a study that backs up my initial statement: https://acleddata.com/2020/09/03/demonstrations-political-violence-in-america-new-data-for-summer-2020/ https://acleddata.com/2020/09/03/demonstrations-political-vi...
    - protocolture 2y ago
      I will have a best effort look for an old article but I cant guarantee anything. >Here's a study that backs up my initial statement They wanted the cop, or at worst the building to burn. Peaceful protests were never going to achieve either. They managed 1/2.
- wayathr0w 2y ago
  What actually happened at 2020's protests & riots in the u.s., in the words of those who were there: https://paper.wf/downas/partisan-accounts-of-the-george-floyd-uprising https://paper.wf/downas/partisan-accounts-of-the-george-floy... Why delegitimizing those who don't abide by the rules of “peaceful protest” amounts to defense of the status quo: https://north-shore.info/2024/10/04/not-liking-someone-doesnt-mean-theyre-a-cop-on-bad-jacketing/ https://north-shore.info/2024/10/04/not-liking-someone-doesn...
sitkack 2y ago
National Lawyers Guild Know Your Rights reminder: Shut the f** up! https://www.youtube.com/watch?v=nWEpW6KOZDs https://www.youtube.com/watch?v=nWEpW6KOZDs https://www.aclu.org/know-your-rights/stopped-by-police https://www.aclu.org/know-your-rights/stopped-by-police
- KennyBlanken 2y ago
  That video, unfortunately, is out of date. The USSC recently decided that if you are merely silent that means you waive your right to remain silent. I wish I were making that up. You now have to repeatedly state it. The USSC has been off the rails for at least ten years.
  - wtfwhateven 2y ago
    https://en.wikipedia.org/wiki/Berghuis_v._Thompkins https://en.wikipedia.org/wiki/Berghuis_v._Thompkins for the curious
  - layman51 2y ago
    Just playing devil’s advocate here, but this idea of having to invoke your fifth amendment rights reminds me of a “Silent Man” (David Hampson) in the UK who would be arrested multiple times for blocking traffic by standing in the middle of the road. I’m not sure of the details, but in the process he would never speak to anyone at all (not even to his lawyer or psychiatrists, or just to confirm his name). It does seem problematic because what happens if the person arrested is actually mute?
    - lazyasciiart 2y ago
      Speech doesn’t have to be verbal.
  - sitkack 2y ago
    Not a lawyer, but the advice they give is still good opsec. Don't talk to anyone except your lawyer. If you are arrested, then yes you do have to assert your right to remain silent. https://www.justia.com/criminal/procedure/miranda-rights/right-to-silence/ https://www.justia.com/criminal/procedure/miranda-rights/rig... Invoke the right and stay silent. Do not answer the obvious bullshit questions, those are used as bait, once you start answering any questions, you lose your 5th amendment protection.
some_furry 2y ago
That they recommend a VPN and not Tor in their first table immediately makes me suspicious. https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29
- fooqux 2y ago
  Why? I've personally seen more news articles about Tor users getting de-anonymized than I have VPN users. Purely anecdotal, I know, but the point being Tor is obviously not foolproof, so I am curious why recommending one over the other is apparently enough for you to call the entire article into question.
  - some_furry 2y ago
    > Why? Because if I was running SIGINT at the NSA and collaborating with the FBI to arrest activists, the very first thing I would do is start up a bunch of VPN providers that bill themselves as "private" and then log everything aggressively. The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes about Tor users being "de-anonymized" when VPN users are never "anonymized" to begin with. I would make sure these anecdotes never clarify whether it's "Tor users accessing Hidden Services and getting popped by a Firefox exploit" or "network attack that enables traffic correlation" so everyone fills in the blanks and assumes Tor is dangerous, when it isn't, thereby pushing activists to my VPN services. After all. There is no real enforcement mechanism if a "private" VPN lies. https://www.theregister.com/2011/09/26/hidemyass_lulzsec_controversy/ https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...
    - roenxi 2y ago
      > The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes An unfortunate factor at play in these matters (and that I note in the article) is that the intelligence services are known to run the occasional shell company [0]. It seems likely that some privacy-oriented providers are actually intelligence fronts - because if you were running an intelligence collection agency an obvious thing to try would be a privacy-focused email company or something. If it isn't built on a trustless model it isn't trustworthy. [0] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
globalnode 2y ago
This is ridiculous, just don't use a network of any kind or you'll be tracked by someone somewhere. Simple as that. Misleading people into thinking they can use these tools and be safe is dangerous. I suppose the only way to be safe is to assume you're being tracked somehow and use burners or throw aways that don't matter.
- jfengel 2y ago
  You need to coordinate with people. It could be as simple and necessary as getting your ride back home after the protest. Yes, any use of the network is a risk. You take a risk just showing up. This is about mitigating risk, not eliminating it. You have to decide if it's a risk worth taking.
- d4mi3n 2y ago
  While you’re not wrong, there’s a trade off between communication needs and security guarantees. Activism and protesting requires organization, which is effectively hampered by the inability to quickly and efficiently disseminate information. I’ve read the EFF’s guide and it seemed reasonable for a layman. What caveats or disclaimers would you include that they haven’t already? What more do you feel could be done to make people with these needs safer while helping them pursue their goals?
  - globalnode 2y ago
    Staying off the radar is the best advice I think - how to do that is the question. The thing that creeps me out is that even at the operating system level we have no idea what happens... look at Recall. I mean wow.
- numpad0 2y ago
  Yeah, the reality of amateur clandestine operations is that you have to put down your phone.
- calt 2y ago
  This advice is unhelpful. Don't let the perfect be the enemy of the good. Cell phones are a useful tool for coordinating and communicating.
FrustratedMonky 2y ago
Is DuckDuckGo really secure? It's just Bing re-skinned. Makes me question the rest of the list.
- mbrubeck 2y ago
  Yes, they use Bing’s search index, but the relevant difference is that they promise not to retain logs of your searches associated with your IP address or other identifying data: https://duckduckgo.com/privacy https://duckduckgo.com/privacy
t4throwaway 2y ago
[dead]
monero-xmr 2y ago
Remember when the FBI and NSA were trying to outlaw encryption? Like a couple years ago? How the turn tables!
- redeux 2y ago
  I’m not sure I understand why the tables are turned now.
  - chitw00d 2y ago
    [dead]
  - lyu07282 2y ago
    It's complicated to explain, but in the republican(/conservative/trump supporter) mind "activists" are (in support of) "far-left marxist communist liberal extremists" like Biden, Obama or Harris, so the FBI/CIA/NSA under the Biden administration were protecting them and calls for making encryption illegal only targeted "the republican" so activists supported ending encryption because it benefited them in their unjust war against republicans. So if they now see activists discussing opsec, they view it as liberals being "scared" at the righteous Trump administration coming for them.
    - monero-xmr 2y ago
      It’s not complex to explain. The establishment was all Democrats and they tried to ban encryption. Now the establishment is Republican and the same elites who tried to take away encryption are now using it.
      - myheartisinohio 2y ago
        Many such cases.
      - lyu07282 2y ago
        Of course it's easy for you to say, but the rest of us do need some explanation to understand what you believe. I assume you aren't against encryption being widely available despite the elites/activists using it for nefarious purposes though? Like you are just pointing out the far-lefts hypocrisy when they tried to ban it before?
jmbwell 2y ago
Is it correct that iCloud backups can lead to officials being able to unlock your physical device? That’s not consistent with my understanding of Apple’s circle of trust implementation. I get that the backups can potentially be compromised, and of course having the backup means having most of what would be on the phone, but I would love to know more about how having a copy of a backup can compromise the physical device via iCloud.
tillulen 2y ago
How much does a Firefox 0-day cost these days on the grey market compared to a Chrome 0-day with sandbox escape?
- tptacek 2y ago
  Drastically less.
- mr_mitm 2y ago
  Not sure how reliable this information is [1], but apparently, 200k vs 500k. Another [2] organization states 350k vs 1.5M (including LPE). [1] https://opzero.ru/en/prices/ https://opzero.ru/en/prices/ [2] https://www.crowdfense.com/exploit-acquisition-program/ https://www.crowdfense.com/exploit-acquisition-program/
- Arech 2y ago
  Disproportionally more if you divide it on the user base to get the cost of targeting 1 user when you want them all (and most of evildoers want that exactly).
  - tptacek 2y ago
    No, that's not at all how the market for high-end zero-day vulnerabilities work. It's interesting to see people just make random stuff up from first principles. Actual market participants have talked through this stuff; you can just find out empirically.
joecool1029 2y ago
Hesitant to recommend proton since they can't stay out of politics, I don't think mullvad has any similar slipups: https://theintercept.com/2025/01/28/proton-mail-andy-yen-trump-republicans/ https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...
- janmo 2y ago
  As I pointed out they also route all of their traffic through Cloudflare. They also have been caught red-handed logging the IP of an activist despite having previously advertised that they didn't keep any logs. Now they are using misleading terms such as "privacy by default" which according to them means that by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so... Sources: https://therecord.media/protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation https://therecord.media/protonmail-forced-to-collect-an-acti... https://x.com/andyyen/status/1884907496705339544 https://x.com/andyyen/status/1884907496705339544
  - logifail 2y ago
    > by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so Not wishing to be negative, but how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system?
    - janmo 2y ago
      The ones that don't end up shut down, in legal trouble or in jail. See Lavabit, Tor Mail, Telegram, EncroChat, Sky ECC and others.
      - nicce 2y ago
        > Telegram You know that Telegram is giving plenty much of information in these days? They even changed the privacy policy. https://techstartups.com/2024/09/06/telegram-silently-updates-its-privacy-policy-removes-privacy-guarantee-after-ceo-pavel-durov-arrest/ https://techstartups.com/2024/09/06/telegram-silently-update...
hitekker 2y ago
For someone in the know: what's the credibility of the authors on this topic? I see https://infosecforactivists.org/#acknowledgments https://infosecforactivists.org/#acknowledgments and https://github.com/InfosecForActivistsTeam/infosec-activists/graphs/contributors https://github.com/InfosecForActivistsTeam/infosec-activists... but I don't see their experience following their own advice. The document by itself looks unpolished. Tor, for example, should be at least referenced once, even if they recommend against it.
- wayathr0w 2y ago
  Can't speak for OP's link, but as a contrast No Trace Project's resources contain lots of advice from people who actually routinely face state repression, with in-depth analysis of specific cases. The scope is international (though focused on the North Atlantic region) rather than english- & u.s.-exclusive. There are plenty of references to Tor+Tails. https://www.notrace.how/ https://www.notrace.how/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6pry...
  - hitekker 2y ago
    Thanks for the links. It's a bit annoying that OP's link turned out to be a LARP; I hope no one actually relies on those people for their security.
janmo 2y ago
This is pretty much the 101 on how to get "caught". It is laughable that they recommend using ProtonMail and ProtonVPN and that there is not a single mention of things such as TOR. Regarding Proton specifically: - Proton has been lying about them not logging their users IP and other information in the past. It got caught red-handed in 2021 when they transmitted the data of a user to a french intelligence agency called DGSI. Source(s): https://therecord.media/protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation https://therecord.media/protonmail-forced-to-collect-an-acti... - Now they say: "Privacy by default", what they mean by it that by default they do not log the user's information but if an agency asks them to log then they "are required by law" to log the user's data. But the user has no way to know if he is still in the "privacy mode" or has switched to the "surveillance mode". - It is actually possible that they log everything and use the "by default" wording as a "plausible denial". By saying that your account had been flagged earlier by law enforcement or an intelligence agency. - All Proton mail traffic goes through Cloudflare. Let that sink in. Yes, they says that the traffic is encrypted using https and that Cloudflare can't see it's content, which might be true. But even if it is true Cloudflare gets to see a ton of interesting meta data, such as the end user's IP, the exact time and the length of what the user is being sending or receiving. Source: So even if you are in Switzerland and you use ProtonMail which is in Switzerland too, your connection still gets tunneled through an American company. Source: https://x.com/andyyen/status/1884907496705339544 https://x.com/andyyen/status/1884907496705339544
chitw00d 2y ago
[flagged]
- aqueueaqueue 2y ago
  What... like downloading an LLM. Or jaywalking. Or keeping a feather. Hell no!
- honestSysAdmin 2y ago
  [dead]
newscracker 2y ago
This page says it was last updated a few weeks ago, but the recommendation against iCloud backups seems to have glaring errors and omissions. > Keys to unlock the phone’s full-disk encryption are also stored in the iCloud backup. This arrangement allows law enforcement to request the backup data from Apple and use the key to unlock the entire phone. It also offers a convenience, where if the user forgets their unlock code, Apple can still recover the device. This is not true. Even if it were, the advice to activists should in all cases be to enable Advanced Data Protection so that almost everything (except iCloud mail, contacts and calendar) are end-to-end encrypted (including iCloud phone backups). Apple cannot access the data or help in any kind of recovery when Advanced Data Protection is enabled. It is up to the user to set up recovery contacts and recovery key (and keep this safe).
- greenie_beans 2y ago
  great! here are the github issues for the repo so you can make that change: https://github.com/InfosecForActivistsTeam/infosec-activists/issues https://github.com/InfosecForActivistsTeam/infosec-activists...
tptacek 2y ago
One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It's an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox seems like it would be the better recommendation, but if what you care about is not being easily (==cheaply) targeted by exploits, it's not.
- Dem0ngo 2y ago
  The point isn't that Firefox is less exploitable it's that it has less blatant tracking than alternatives like Chrome. If you're an activist I'd imagine that exploits are a scary thought but the more direct threat is the tracking we (un)knowingly succumb to every day.
  - idlewords 2y ago
    If your threat model is tracking, then worry about carrying around the 24/7 tracking device more than the specific software you run on it.
    - fsflover 2y ago
      Isn't it the software which is tracking you? You can switch off the cellular connection whenever you need to not be tracked by the towers (if you trust your software, or with a hardware switch on some phones).
      - tptacek 2y ago
        See, again: this is how message board logic turns these kinds of guides into LARPs. "Turn off your cellular connection whenever you need to not be tracked. Also use ProtonVPN."
- jrm4 2y ago
  This is not smart. It's entirely reasonable that Chrome may be better on top of its exploit game; but this absolutely pales in comparison to the threat of universal surveillance that Google hits us with frequently. Shouts to the heroes on the inside, but what did I just hear about an AI removal pledge?
DavidPiper 2y ago
Serious question: what are the reasons for Firefox over Safari? I'm currently a Firefox user at home and work, but thinking about going back to Safari in the near future...
- XorNot 2y ago
  Firefox is open source. You don't have to build it yourself, but other people do and deterministic builds can provide collective assurance the code is what it claims to be.
- withinboredom 2y ago
  I've had the opportunity to work with the safari team in the past. I can't say a lot due to an NDA, but lets just say there is a good reason to prefer Firefox.
- nickthegreek 2y ago
  I use multiple OS's throughout the day. Firefox works on all OS's smoothly. Safari doesn't let you set a custom search engine. Firefox has some great extensions.
- fsflover 2y ago
  https://news.ycombinator.com/item?id=42859836 https://news.ycombinator.com/item?id=42859836
axegon_ 2y ago
I am really struggling to find ways to approve anything if you don't have 100% control over it. Signal seems to be a solid choice generally and I do believe they are doing their absolute best to keep it airtight but this is software and some obscene, tiny little hole may very well exist. Generally speaking, with people like comrade elon having so much say into everything, people rushing to pump out new features daily, most often not putting too much effort into security, I've been making a hard push to cut myself off cloud services and self-host everything I can myself.
cess11 2y ago
Yeah, don't use Proton, they're several types of shady. If you can figure out running Matrix, that's better. Email isn't built for security, don't treat it as if it was. Use PGP on the body if you want, but the metadata will still be very talkative. The Grugq has complementary advice which arguably is more important, regarding foundational principles, personas and so on: https://www.youtube.com/watch?v=L3j1AhS0iKI https://www.youtube.com/watch?v=L3j1AhS0iKI https://www.youtube.com/watch?v=3w7E4Hhtubw https://www.youtube.com/watch?v=3w7E4Hhtubw (there's a bit of presentation and ceremony before they get into the relevant parts)
neilv 2y ago
Step 1: Determine your threat model. Step 2: Realize that none of these measures are adequate for that threat model, in the current environment. (For pretty much any threat model.) Step 3: Realize that some of these measures draw attention to yourself, however.
- mexicocitinluez 2y ago
  wut? How is removing biometric auth going to draw attention to yourself? Also, would love to know why this isn't an adequate measure for security.
  - dylan604 2y ago
    "realize some" was the comment. you're now assuming that biometric auth is part of that "some". assuming can get you into trouble. if biometric auth does not bring attention to yourself, that does not negate the validity of the comment. people just need to calm down with the "gotcha" comments
    - mexicocitinluez 2y ago
      > : Realize that none of these measures are adequate for that threat model, Just take the fucking L and move on. Christ.
      - adolph 2y ago
        Just take a breath and reread the difference between steps two and three.
- aendruk 2y ago
  > Realize that some of these measures draw attention to yourself This makes a good case for using them all the rest of the time. If you’re in a relatively safe position you can help to normalize privacy to provide cover for those who need it now, and perhaps for yourself should you need it in the future.
- 2y ago
cherryteastain 2y ago
I personally don't believe basic measures like turning off location services as suggested by the article will make a difference against a sophisticated adversary like a state actor. We know that modern phones are full of proprietary firmware with swiss cheese tier security which allow for 0 day remote code execution exploits [1]. The operating systems, although better, also have been targeted by RCE exploits [2]. Not to mention even turning a phone off does not guarantee it goes silent. Apple's Find My network works even for turned off devices. Now of course you can turn that feature off, but once the capability to track a turned off device is there, we have to assume that a nation state actor has exploits/backdoors that allow agencies to bypass basic software switches. You have to assume everything you do on a mobile phone will end up in law enforcement/intelligence agency databases if you're put on a watch list. [1] https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html?m=1 https://googleprojectzero.blogspot.com/2023/03/multiple-inte... [2] https://en.m.wikipedia.org/wiki/Pegasus_(spyware) https://en.m.wikipedia.org/wiki/Pegasus_(spyware)
- _joel 2y ago
  Agreed, when they can own the baseband, you're kinda screwed. edit: my knowledge is clearly out of date.
  - jorvi 2y ago
    Since the mid-2010s Apple has put every baseband / WiFi / Bluetooth radio either on USB or PCIe with an IOMMU that restricts access to only the pages required for networking and packet management. I can't speak to when Android started doing this, but I know the common chipsets (Qualcomm, Exynos, Mediatek) also do this.
- ReptileMan 2y ago
  >I personally don't believe basic measures like turning off location services as suggested by the article will make a difference against a sophisticated adversary like a state actor. The majority of activists are not worth the effort or expense. And for the ones that are worth - those guides make no difference since they don't harden as much. If you want real security - then the least you must do is have two devices. One used for hotspot only.
wayathr0w 2y ago
Some of the crowd here is already aware of the issues with these recommendations, so let's take things up a level. https://www.notrace.how/ https://www.notrace.how/ / http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6pry... https://www.anarsec.guide/ https://www.anarsec.guide/
- Peacefulz 2y ago
  Thanks! This looks like some interesting reading.
throwfgtpwd234 2y ago
Signal leads to metadata by virtue of demanding a phone number. Use the fork Session instead that doesn't have this vulnerability. Or Mega, which does audio and video calls, chat, and file storage and transfer.
FollowingTheDao 2y ago
Rule 0: DO NOT BRING YOUR PHONE TO PROTESTS. I cannot stress this enough. We survived protests without them in the past. There will be plenty of professionals filming anything going on. Coordination needs to be zero tech.
- sjducb 2y ago
  This is the right answer. Bring a map and an action camera, maybe a burner dumbphone.
greenie_beans 2y ago
all yall HN "well actually" MF missing the point. this is meant for non-technical people
sharpshadow 2y ago
One could use a portable programmable network device between the phone and wifi for increased security.
emocin 2y ago
> proton Immediately closed tab, this post is useless.
seethishat 2y ago
It's hard for me to believe that people actually think they can use Signal or some other 'security app' on a device that is fundamentally compromised already. Sure, your messages are encrypted, but they (whoever they are) have the private keys (both sender and receiver) because the smart phones you are using are compromised by them. It's really simple. So next time you read a news story about criminals who were using some supposedly secure app to commit crimes, but got caught anyway... keep this in mind.
- b8 2y ago
  Yep, Cellebrite is popular among LE and my phone (a new Pixel) is able is be extracted. Even if I install a privacy OS such as GrapheneOS, I don't think it would help. The Librem phone looks nice, but it costs a lot and the camera/specs are bad.
  - seethishat 2y ago
    Exactly. Just don't commit crimes and don't use a phone/computer to commit crimes thinking you will get away with it. It doesn't work, they know who you are and what you did. It's really simple.
    - ziddoap 2y ago
      Great to learn that across all of history, only criminals are subject to searches and there has never been corruption in law enforcement.
    - robertwebb 2y ago
      [dead]
    - rexpop 2y ago
      > Just don't commit crimes. This is a really, really ignorant imperative. First of all, the criminalization of poverty and structural injustice, generally, make technically criminal activity inevitable in some communities, but I recognize that what you actually mean is "don't commit criminal acts of protest" which is still ludicrously ignorant—and cruel! Civil disobedience, by definition, involves the deliberate violation of a law. It is, nevertheless, our duty to perform when laws or systems perpetuate severe injustices, democratic failures, or lack legitimacy. As John F. Kennedy famously put it, "Those who make [legal] revolution impossible will make [criminal] revolution inevitable." This is economics.
fortyseven 2y ago
If I'm going to be involved in something like this I'm sure as hell not bringing my daily driver phone. Get serious. Grab a burner, go in expecting it to get discarded or to fall into unfriendly hands.
throwaway_43210 2y ago
> We recommend Signal, which was built from the ground up for personal security. WhatsApp has E2EE for all messages too, I don't understand why people think of Signal as a bullet-proof instant messaging solution for privacy, especially when 1. Requires Phone Number in order to use (I'm sure fanboys have explanations for that) 2. It is centralized 3. Uses APNs or GCM for push notifications
- Ylpertnodi 2y ago
  For me, the difference choosing between whatsapp and signal has more to do the who is in, and behind, the respective companies. Liar Zuckerberg lost by fvcking mile.
unethical_ban 2y ago
I wonder how many of the posts here saying "this is all useless" actually go to protest, or in their heart support those who do. Can the full might of the fbi and nsa own you of they want? Likely. The threat model here is local PD, and the goal is to make their job of incriminating you in any way, harder. Meaning making it harder to get into your phone. Harder to passively intercept data like sms and phone calls. Harder to get days by asking the big companies like google.
- unethical_ban 2y ago
  *harder to get data by asking
pithanyChan 2y ago
> Intrusion Protection Any ways to check the current updated official images against what is installed on the phone or notebook via a oneliner or an app? Like in a couple of minutes like a virus scan. Burning the hardware is one thing but having confirmation would be nice.
_DeadFred_ 2y ago
Not infosec but when washing off pepper spray/tear gas, don't let it run down 'sensitive' areas.
rpgwaiter 2y ago
Good article, although it stresses the need to have trusted friends to protest with but doesn’t explain how to find, make, keep these friends. To be fair, I’ve been trying to figure that part put for like 10 years but it would be cool to have advice in that area as well. Keep up the good fight!
- samothrace 2y ago
  I think the recommendation is to go to events relevant to your interests, actively contribute, and speak to people.
bitbasher 2y ago
All of their advice is pretty moot because they are saying you should have your phone with you and that alone is going to hit cell towers and put you at the location of the action.
- Xen9 2y ago
  Not so if you EMI tape the GOS phone case, disable USB-C except for charging, use second profile to encrypt your actual data so you can attest before decrypting, and keep it turned off and in aeroplane mode when not in use. See my comments.
  - bitbasher 2y ago
    Your phone going “dark” during an action is in itself a signal that you are involved in the action. Especially when it deviates from your phones normal activity patterns. It would make more sense to leave your phone on and at home. However, you can’t use any of the tools the articles lists if you have no phone.
    - Xen9 2y ago
      That's why you keep it offline at all times! And for calls use something dumb & leave that at home.
treebeard901 2y ago
As someone who has decades of tech experience and have been the target of various Government agencies for many years... I have a few things to add: Most devices have some kind of GPS or positioning system. Phones in particular still communicate certain information to cell towers and E911 even if there is no SIM installed. Wrapping your phone in aluminum foil does not block all the signals as many have been lead to believe. It is not certain, especially with 5G what faraday bags can work. Your best bet is a phone where you can remove the battery. Even this could leave residual power in the device. One of the most non technical aspects of Government surveillance, especially in the United States, is that their ability to request data depends on each specific provider. Usually, law enforcement has long standing relationships with all these companies and the higher up you go in the U.S. Govt, you get more of this. After all, there are a million ways the Govt can keep a device off the market if they do not comply with whatever the Government wants. Maybe most importantly, parallel construction is often used here. For example, law enforcement will only follow the rules and get a warrant if they intend to present a case in court. Often, they just want information and if they want to use it they will find a way to parallel construct its source. Do not rely on your constitutional protections or anything else. In many cases it is simply not a factor for them. Everything about your phone comes back to the sim card. It is extremely difficult to get a working SIM without some form of ID. Most SIM cards are traceable this way, especially if you purchase them in the U.S. Most services require a form of authentication as well, often a phone number which requires the SIM belong to someone, or an email address, which very often requires a phone number to create. Used burner phones are your best bet. Any cloud service connection your phone initiates is able to be intercepted and the Govt can deploy a form of a man in the middle decryption attack with the help of your cell provider. This is not used as often but unless everything you have uses certificate pinning, and often this isn't the case, it is very easy to man in the middle your end to end traffic and decrypt it. Applications also leak like crazy to various APIs and other things they use. Connections can be downgraded to HTTP and all other forms of tricks to monitor you are used. For example, if you are using an end to end encrypted messaging app, and you have the content of those messages going to the apple or google notification system, you do not have end to end encrypted messaging. This is why Signal disables the content in the notification by default. There are other attack surfaces here as well. Keyboard autocomplete is one as it uses remote services. If LE knows you are using something like Signal, and they can see you created a new contact on your phone to message them, they already know who you are talking to you, and if your phone keyboard is using autocomplete or grammar correct, they could potentially get what both sides are writing to each other without actually breaking the encryption. There are other methods as well. iPhones have the ability to use a form of Remote Desktop that can be accessed over the cell connection. So as you are using the app, your screen can be monitored, thus defeating any encryption security you think you have. If Law enforcement knows you have cloud accounts, say with iCloud or Google Docs, and you are working on something in there, you can be sure that it is possible for your work to be viewed as you are working on it. This has a ton of implications for people just doing normal non activist work as well. Maybe you're working on your own legal case and they can literally just watch you build a legal defense and then plan accordingly. It really is endless what they can do. If the Govt is interested in you, most cities are full surveillance cities now. You can have no phone, no RFID anything, change your routes, change your appearance and you will still be found. There are rare exceptions to this but for the most part assume you cannot move around a city without being constantly monitored. Even if you only have a pair of bluetooth headphones, there are all kinds of devices collecting broadcast data, and these can be correlated with device lists uploaded when you pair a device. This is just a short list of things I've experienced personally... There is so much more. Any large formal resistance basically cannot happen without the Govt knowing about it. EDIT: Sorry for the wall of text

486 points by greenie_beans 2y ago

More resources on this topic: Activist or Protester? by EFF's Surveillance Self Defense https://ssd.eff.org/playlist/activist-or-protester https://ssd.eff.org/playlist/activist-or-protester The Protester's Guide to Smartphone Security by Privacy Guides https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/ https://www.privacyguides.org/articles/2025/01/23/activists-...

frontalier 2y ago
eff's a good source for most people on most occasions for everything else read material from anarchists. ex: https://opsec.riotmedicine.net/downloads#mobile-phone-security https://opsec.riotmedicine.net/downloads#mobile-phone-securi...

pstuart 2y ago

A bit of a tangent, but modern protests are subject to hijacking from agents provocateur and general shit stirrers -- it's been quite effective in delegitimizing public protests. It would be nice to find ways to counter that. Case in point: how BLM protests were turned into riots by antagonistic forces: https://abcnews.go.com/US/man-helped-ignite-george-floyd-riots-identified-white/story?id=72051536 https://abcnews.go.com/US/man-helped-ignite-george-floyd-rio...

youainti 2y ago
I think this was the whole point of the "self purification" process that Dr ML King Jr describes in his Letter from Birmingham Jail [0], where they had workshops on non-violence etc. [0] https://letterfromjail.com/ https://letterfromjail.com/
blackeyeblitzar 2y ago
[flagged]
- RajT88 2y ago
  Blocking a highway is not an act of violence, it is a form of peaceful protest. Like a diner sit-in. You are free to correct your post to explain all the acts of violence you saw which justify the term "riot".
  - WaitWaitWha 2y ago
    There are multiple documented cases where emergency vehicles are blocked by "blocking a highway" as a "peaceful protest" that resulted in deaths. e.g., London (2022) - Mark Heap and Lisa Webber.
    - RajT88 2y ago
      That does not a riot make. It is still a peaceful protest, whether you like it or not, contingent on the definition of "peaceful" being the absence of violence. You do not have to like the outcome of a protest, but if it is not a violent one, you are expected here to describe it in accurate language. You are not doing that. To illustrate my point: your logic dictates that not pulling over for an emergency vehicle is tantamount to assault. It is not, and should never be in any rational society. Agree? Disagree?
      - WaitWaitWha 2y ago
        I was responding to your note that it is peaceful, not that is or is not a riot. A gathering where someone dies because of the gathering it is no longer undisturbed by strife, turmoil, calm, and tranquil. It is no longer peaceful. > ... contingent on the definition of "peaceful" being the absence of violence. The breaking of peaceful to me is not absence of violence. It is no longer peaceful because force was used to stop the emergency vehicles. Force is one way to be no longer peaceful. In this context, when force is used it implies resistance from someone that was forced to do something they did not want to do (emergency vehicle did not want to stop). It is no longer peaceful; yet no direct "violence" was used.[1] I can fathom where your response comes and grasp your interpretation, but I disagree. [1] https://help.unhcr.org/iran/en/more-information/what-is-violence/ https://help.unhcr.org/iran/en/more-information/what-is-viol...
protocolture 2y ago
Interesting. I read an article stating the opposite. That to organise effective action on the ground, smart protesters were distracting the anti violence bleeding hearts while discussing and implementing more effective actions. In particular it was stated that part of those particular riots were a distraction to (successfully iirc) lure the cops away from the police station.
- pstuart 2y ago
  > I read an article stating the opposite. Please share a link then. > That to organise effective action on the ground, smart protesters were distracting the anti violence bleeding hearts while discussing and implementing more effective actions. There's a lot to be unpacked there, but I'm not sure about what you think is "effective action" and why peaceful demonstrators are a bad thing. Here's a study that backs up my initial statement: https://acleddata.com/2020/09/03/demonstrations-political-violence-in-america-new-data-for-summer-2020/ https://acleddata.com/2020/09/03/demonstrations-political-vi...
  - protocolture 2y ago
    I will have a best effort look for an old article but I cant guarantee anything. >Here's a study that backs up my initial statement They wanted the cop, or at worst the building to burn. Peaceful protests were never going to achieve either. They managed 1/2.
wayathr0w 2y ago
What actually happened at 2020's protests & riots in the u.s., in the words of those who were there: https://paper.wf/downas/partisan-accounts-of-the-george-floyd-uprising https://paper.wf/downas/partisan-accounts-of-the-george-floy... Why delegitimizing those who don't abide by the rules of “peaceful protest” amounts to defense of the status quo: https://north-shore.info/2024/10/04/not-liking-someone-doesnt-mean-theyre-a-cop-on-bad-jacketing/ https://north-shore.info/2024/10/04/not-liking-someone-doesn...

sitkack 2y ago

National Lawyers Guild Know Your Rights reminder: Shut the f** up! https://www.youtube.com/watch?v=nWEpW6KOZDs https://www.youtube.com/watch?v=nWEpW6KOZDs https://www.aclu.org/know-your-rights/stopped-by-police https://www.aclu.org/know-your-rights/stopped-by-police

KennyBlanken 2y ago
That video, unfortunately, is out of date. The USSC recently decided that if you are merely silent that means you waive your right to remain silent. I wish I were making that up. You now have to repeatedly state it. The USSC has been off the rails for at least ten years.
- wtfwhateven 2y ago
  https://en.wikipedia.org/wiki/Berghuis_v._Thompkins https://en.wikipedia.org/wiki/Berghuis_v._Thompkins for the curious
- layman51 2y ago
  Just playing devil’s advocate here, but this idea of having to invoke your fifth amendment rights reminds me of a “Silent Man” (David Hampson) in the UK who would be arrested multiple times for blocking traffic by standing in the middle of the road. I’m not sure of the details, but in the process he would never speak to anyone at all (not even to his lawyer or psychiatrists, or just to confirm his name). It does seem problematic because what happens if the person arrested is actually mute?
  - lazyasciiart 2y ago
    Speech doesn’t have to be verbal.
- sitkack 2y ago
  Not a lawyer, but the advice they give is still good opsec. Don't talk to anyone except your lawyer. If you are arrested, then yes you do have to assert your right to remain silent. https://www.justia.com/criminal/procedure/miranda-rights/right-to-silence/ https://www.justia.com/criminal/procedure/miranda-rights/rig... Invoke the right and stay silent. Do not answer the obvious bullshit questions, those are used as bait, once you start answering any questions, you lose your 5th amendment protection.

some_furry 2y ago

That they recommend a VPN and not Tor in their first table immediately makes me suspicious. https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29

fooqux 2y ago
Why? I've personally seen more news articles about Tor users getting de-anonymized than I have VPN users. Purely anecdotal, I know, but the point being Tor is obviously not foolproof, so I am curious why recommending one over the other is apparently enough for you to call the entire article into question.
- some_furry 2y ago
  > Why? Because if I was running SIGINT at the NSA and collaborating with the FBI to arrest activists, the very first thing I would do is start up a bunch of VPN providers that bill themselves as "private" and then log everything aggressively. The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes about Tor users being "de-anonymized" when VPN users are never "anonymized" to begin with. I would make sure these anecdotes never clarify whether it's "Tor users accessing Hidden Services and getting popped by a Firefox exploit" or "network attack that enables traffic correlation" so everyone fills in the blanks and assumes Tor is dangerous, when it isn't, thereby pushing activists to my VPN services. After all. There is no real enforcement mechanism if a "private" VPN lies. https://www.theregister.com/2011/09/26/hidemyass_lulzsec_controversy/ https://www.theregister.com/2011/09/26/hidemyass_lulzsec_con...
  - roenxi 2y ago
    > The second thing I would do is have useful idiots (i.e., influencers) spread vague anecdotes An unfortunate factor at play in these matters (and that I note in the article) is that the intelligence services are known to run the occasional shell company [0]. It seems likely that some privacy-oriented providers are actually intelligence fronts - because if you were running an intelligence collection agency an obvious thing to try would be a privacy-focused email company or something. If it isn't built on a trustless model it isn't trustworthy. [0] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG

globalnode 2y ago

This is ridiculous, just don't use a network of any kind or you'll be tracked by someone somewhere. Simple as that. Misleading people into thinking they can use these tools and be safe is dangerous. I suppose the only way to be safe is to assume you're being tracked somehow and use burners or throw aways that don't matter.

jfengel 2y ago
You need to coordinate with people. It could be as simple and necessary as getting your ride back home after the protest. Yes, any use of the network is a risk. You take a risk just showing up. This is about mitigating risk, not eliminating it. You have to decide if it's a risk worth taking.
d4mi3n 2y ago
While you’re not wrong, there’s a trade off between communication needs and security guarantees. Activism and protesting requires organization, which is effectively hampered by the inability to quickly and efficiently disseminate information. I’ve read the EFF’s guide and it seemed reasonable for a layman. What caveats or disclaimers would you include that they haven’t already? What more do you feel could be done to make people with these needs safer while helping them pursue their goals?
- globalnode 2y ago
  Staying off the radar is the best advice I think - how to do that is the question. The thing that creeps me out is that even at the operating system level we have no idea what happens... look at Recall. I mean wow.
numpad0 2y ago
Yeah, the reality of amateur clandestine operations is that you have to put down your phone.
calt 2y ago
This advice is unhelpful. Don't let the perfect be the enemy of the good. Cell phones are a useful tool for coordinating and communicating.

FrustratedMonky 2y ago

Is DuckDuckGo really secure? It's just Bing re-skinned. Makes me question the rest of the list.

mbrubeck 2y ago
Yes, they use Bing’s search index, but the relevant difference is that they promise not to retain logs of your searches associated with your IP address or other identifying data: https://duckduckgo.com/privacy https://duckduckgo.com/privacy

t4throwaway 2y ago

[dead]

monero-xmr 2y ago

Remember when the FBI and NSA were trying to outlaw encryption? Like a couple years ago? How the turn tables!

redeux 2y ago
I’m not sure I understand why the tables are turned now.
- chitw00d 2y ago
  [dead]
- lyu07282 2y ago
  It's complicated to explain, but in the republican(/conservative/trump supporter) mind "activists" are (in support of) "far-left marxist communist liberal extremists" like Biden, Obama or Harris, so the FBI/CIA/NSA under the Biden administration were protecting them and calls for making encryption illegal only targeted "the republican" so activists supported ending encryption because it benefited them in their unjust war against republicans. So if they now see activists discussing opsec, they view it as liberals being "scared" at the righteous Trump administration coming for them.
  - monero-xmr 2y ago
    It’s not complex to explain. The establishment was all Democrats and they tried to ban encryption. Now the establishment is Republican and the same elites who tried to take away encryption are now using it.
    - myheartisinohio 2y ago
      Many such cases.
    - lyu07282 2y ago
      Of course it's easy for you to say, but the rest of us do need some explanation to understand what you believe. I assume you aren't against encryption being widely available despite the elites/activists using it for nefarious purposes though? Like you are just pointing out the far-lefts hypocrisy when they tried to ban it before?

jmbwell 2y ago

Is it correct that iCloud backups can lead to officials being able to unlock your physical device? That’s not consistent with my understanding of Apple’s circle of trust implementation. I get that the backups can potentially be compromised, and of course having the backup means having most of what would be on the phone, but I would love to know more about how having a copy of a backup can compromise the physical device via iCloud.

tillulen 2y ago

How much does a Firefox 0-day cost these days on the grey market compared to a Chrome 0-day with sandbox escape?

tptacek 2y ago
Drastically less.
mr_mitm 2y ago
Not sure how reliable this information is [1], but apparently, 200k vs 500k. Another [2] organization states 350k vs 1.5M (including LPE). [1] https://opzero.ru/en/prices/ https://opzero.ru/en/prices/ [2] https://www.crowdfense.com/exploit-acquisition-program/ https://www.crowdfense.com/exploit-acquisition-program/
Arech 2y ago
Disproportionally more if you divide it on the user base to get the cost of targeting 1 user when you want them all (and most of evildoers want that exactly).
- tptacek 2y ago
  No, that's not at all how the market for high-end zero-day vulnerabilities work. It's interesting to see people just make random stuff up from first principles. Actual market participants have talked through this stuff; you can just find out empirically.

joecool1029 2y ago

Hesitant to recommend proton since they can't stay out of politics, I don't think mullvad has any similar slipups: https://theintercept.com/2025/01/28/proton-mail-andy-yen-trump-republicans/ https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...

janmo 2y ago
As I pointed out they also route all of their traffic through Cloudflare. They also have been caught red-handed logging the IP of an activist despite having previously advertised that they didn't keep any logs. Now they are using misleading terms such as "privacy by default" which according to them means that by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so... Sources: https://therecord.media/protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation https://therecord.media/protonmail-forced-to-collect-an-acti... https://x.com/andyyen/status/1884907496705339544 https://x.com/andyyen/status/1884907496705339544
- logifail 2y ago
  > by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so Not wishing to be negative, but how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system?
  - janmo 2y ago
    The ones that don't end up shut down, in legal trouble or in jail. See Lavabit, Tor Mail, Telegram, EncroChat, Sky ECC and others.
    - nicce 2y ago
      > Telegram You know that Telegram is giving plenty much of information in these days? They even changed the privacy policy. https://techstartups.com/2024/09/06/telegram-silently-updates-its-privacy-policy-removes-privacy-guarantee-after-ceo-pavel-durov-arrest/ https://techstartups.com/2024/09/06/telegram-silently-update...

hitekker 2y ago

For someone in the know: what's the credibility of the authors on this topic? I see https://infosecforactivists.org/#acknowledgments https://infosecforactivists.org/#acknowledgments and https://github.com/InfosecForActivistsTeam/infosec-activists/graphs/contributors https://github.com/InfosecForActivistsTeam/infosec-activists... but I don't see their experience following their own advice. The document by itself looks unpolished. Tor, for example, should be at least referenced once, even if they recommend against it.

wayathr0w 2y ago
Can't speak for OP's link, but as a contrast No Trace Project's resources contain lots of advice from people who actually routinely face state repression, with in-depth analysis of specific cases. The scope is international (though focused on the North Atlantic region) rather than english- & u.s.-exclusive. There are plenty of references to Tor+Tails. https://www.notrace.how/ https://www.notrace.how/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6pry...
- hitekker 2y ago
  Thanks for the links. It's a bit annoying that OP's link turned out to be a LARP; I hope no one actually relies on those people for their security.

janmo 2y ago

This is pretty much the 101 on how to get "caught". It is laughable that they recommend using ProtonMail and ProtonVPN and that there is not a single mention of things such as TOR. Regarding Proton specifically: - Proton has been lying about them not logging their users IP and other information in the past. It got caught red-handed in 2021 when they transmitted the data of a user to a french intelligence agency called DGSI. Source(s): https://therecord.media/protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation https://therecord.media/protonmail-forced-to-collect-an-acti... - Now they say: "Privacy by default", what they mean by it that by default they do not log the user's information but if an agency asks them to log then they "are required by law" to log the user's data. But the user has no way to know if he is still in the "privacy mode" or has switched to the "surveillance mode". - It is actually possible that they log everything and use the "by default" wording as a "plausible denial". By saying that your account had been flagged earlier by law enforcement or an intelligence agency. - All Proton mail traffic goes through Cloudflare. Let that sink in. Yes, they says that the traffic is encrypted using https and that Cloudflare can't see it's content, which might be true. But even if it is true Cloudflare gets to see a ton of interesting meta data, such as the end user's IP, the exact time and the length of what the user is being sending or receiving. Source: So even if you are in Switzerland and you use ProtonMail which is in Switzerland too, your connection still gets tunneled through an American company. Source: https://x.com/andyyen/status/1884907496705339544 https://x.com/andyyen/status/1884907496705339544

chitw00d 2y ago

[flagged]

aqueueaqueue 2y ago
What... like downloading an LLM. Or jaywalking. Or keeping a feather. Hell no!
honestSysAdmin 2y ago
[dead]

newscracker 2y ago

This page says it was last updated a few weeks ago, but the recommendation against iCloud backups seems to have glaring errors and omissions. > Keys to unlock the phone’s full-disk encryption are also stored in the iCloud backup. This arrangement allows law enforcement to request the backup data from Apple and use the key to unlock the entire phone. It also offers a convenience, where if the user forgets their unlock code, Apple can still recover the device. This is not true. Even if it were, the advice to activists should in all cases be to enable Advanced Data Protection so that almost everything (except iCloud mail, contacts and calendar) are end-to-end encrypted (including iCloud phone backups). Apple cannot access the data or help in any kind of recovery when Advanced Data Protection is enabled. It is up to the user to set up recovery contacts and recovery key (and keep this safe).

greenie_beans 2y ago
great! here are the github issues for the repo so you can make that change: https://github.com/InfosecForActivistsTeam/infosec-activists/issues https://github.com/InfosecForActivistsTeam/infosec-activists...

tptacek 2y ago

One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It's an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox seems like it would be the better recommendation, but if what you care about is not being easily (==cheaply) targeted by exploits, it's not.

Dem0ngo 2y ago
The point isn't that Firefox is less exploitable it's that it has less blatant tracking than alternatives like Chrome. If you're an activist I'd imagine that exploits are a scary thought but the more direct threat is the tracking we (un)knowingly succumb to every day.
- idlewords 2y ago
  If your threat model is tracking, then worry about carrying around the 24/7 tracking device more than the specific software you run on it.
  - fsflover 2y ago
    Isn't it the software which is tracking you? You can switch off the cellular connection whenever you need to not be tracked by the towers (if you trust your software, or with a hardware switch on some phones).
    - tptacek 2y ago
      See, again: this is how message board logic turns these kinds of guides into LARPs. "Turn off your cellular connection whenever you need to not be tracked. Also use ProtonVPN."
jrm4 2y ago
This is not smart. It's entirely reasonable that Chrome may be better on top of its exploit game; but this absolutely pales in comparison to the threat of universal surveillance that Google hits us with frequently. Shouts to the heroes on the inside, but what did I just hear about an AI removal pledge?

DavidPiper 2y ago

Serious question: what are the reasons for Firefox over Safari? I'm currently a Firefox user at home and work, but thinking about going back to Safari in the near future...

XorNot 2y ago
Firefox is open source. You don't have to build it yourself, but other people do and deterministic builds can provide collective assurance the code is what it claims to be.
withinboredom 2y ago
I've had the opportunity to work with the safari team in the past. I can't say a lot due to an NDA, but lets just say there is a good reason to prefer Firefox.
nickthegreek 2y ago
I use multiple OS's throughout the day. Firefox works on all OS's smoothly. Safari doesn't let you set a custom search engine. Firefox has some great extensions.
fsflover 2y ago
https://news.ycombinator.com/item?id=42859836 https://news.ycombinator.com/item?id=42859836

axegon_ 2y ago

I am really struggling to find ways to approve anything if you don't have 100% control over it. Signal seems to be a solid choice generally and I do believe they are doing their absolute best to keep it airtight but this is software and some obscene, tiny little hole may very well exist. Generally speaking, with people like comrade elon having so much say into everything, people rushing to pump out new features daily, most often not putting too much effort into security, I've been making a hard push to cut myself off cloud services and self-host everything I can myself.

cess11 2y ago

Yeah, don't use Proton, they're several types of shady. If you can figure out running Matrix, that's better. Email isn't built for security, don't treat it as if it was. Use PGP on the body if you want, but the metadata will still be very talkative. The Grugq has complementary advice which arguably is more important, regarding foundational principles, personas and so on: https://www.youtube.com/watch?v=L3j1AhS0iKI https://www.youtube.com/watch?v=L3j1AhS0iKI https://www.youtube.com/watch?v=3w7E4Hhtubw https://www.youtube.com/watch?v=3w7E4Hhtubw (there's a bit of presentation and ceremony before they get into the relevant parts)

neilv 2y ago

Step 1: Determine your threat model. Step 2: Realize that none of these measures are adequate for that threat model, in the current environment. (For pretty much any threat model.) Step 3: Realize that some of these measures draw attention to yourself, however.

mexicocitinluez 2y ago
wut? How is removing biometric auth going to draw attention to yourself? Also, would love to know why this isn't an adequate measure for security.
- dylan604 2y ago
  "realize some" was the comment. you're now assuming that biometric auth is part of that "some". assuming can get you into trouble. if biometric auth does not bring attention to yourself, that does not negate the validity of the comment. people just need to calm down with the "gotcha" comments
  - mexicocitinluez 2y ago
    > : Realize that none of these measures are adequate for that threat model, Just take the fucking L and move on. Christ.
    - adolph 2y ago
      Just take a breath and reread the difference between steps two and three.
aendruk 2y ago
> Realize that some of these measures draw attention to yourself This makes a good case for using them all the rest of the time. If you’re in a relatively safe position you can help to normalize privacy to provide cover for those who need it now, and perhaps for yourself should you need it in the future.
2y ago

cherryteastain 2y ago

I personally don't believe basic measures like turning off location services as suggested by the article will make a difference against a sophisticated adversary like a state actor. We know that modern phones are full of proprietary firmware with swiss cheese tier security which allow for 0 day remote code execution exploits [1]. The operating systems, although better, also have been targeted by RCE exploits [2]. Not to mention even turning a phone off does not guarantee it goes silent. Apple's Find My network works even for turned off devices. Now of course you can turn that feature off, but once the capability to track a turned off device is there, we have to assume that a nation state actor has exploits/backdoors that allow agencies to bypass basic software switches. You have to assume everything you do on a mobile phone will end up in law enforcement/intelligence agency databases if you're put on a watch list. [1] https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html?m=1 https://googleprojectzero.blogspot.com/2023/03/multiple-inte... [2] https://en.m.wikipedia.org/wiki/Pegasus_(spyware) https://en.m.wikipedia.org/wiki/Pegasus_(spyware)

_joel 2y ago
Agreed, when they can own the baseband, you're kinda screwed. edit: my knowledge is clearly out of date.
- jorvi 2y ago
  Since the mid-2010s Apple has put every baseband / WiFi / Bluetooth radio either on USB or PCIe with an IOMMU that restricts access to only the pages required for networking and packet management. I can't speak to when Android started doing this, but I know the common chipsets (Qualcomm, Exynos, Mediatek) also do this.
ReptileMan 2y ago
>I personally don't believe basic measures like turning off location services as suggested by the article will make a difference against a sophisticated adversary like a state actor. The majority of activists are not worth the effort or expense. And for the ones that are worth - those guides make no difference since they don't harden as much. If you want real security - then the least you must do is have two devices. One used for hotspot only.

wayathr0w 2y ago

Some of the crowd here is already aware of the issues with these recommendations, so let's take things up a level. https://www.notrace.how/ https://www.notrace.how/ / http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6prycad.onion/ http://i4pd4zpyhrojnyx5l3d2siauy4almteocqow4bp2lqxyocrfy6pry... https://www.anarsec.guide/ https://www.anarsec.guide/

Peacefulz 2y ago
Thanks! This looks like some interesting reading.

throwfgtpwd234 2y ago

Signal leads to metadata by virtue of demanding a phone number. Use the fork Session instead that doesn't have this vulnerability. Or Mega, which does audio and video calls, chat, and file storage and transfer.

FollowingTheDao 2y ago

Rule 0: DO NOT BRING YOUR PHONE TO PROTESTS. I cannot stress this enough. We survived protests without them in the past. There will be plenty of professionals filming anything going on. Coordination needs to be zero tech.

sjducb 2y ago
This is the right answer. Bring a map and an action camera, maybe a burner dumbphone.

greenie_beans 2y ago

all yall HN "well actually" MF missing the point. this is meant for non-technical people

sharpshadow 2y ago

One could use a portable programmable network device between the phone and wifi for increased security.

emocin 2y ago

> proton Immediately closed tab, this post is useless.

seethishat 2y ago

It's hard for me to believe that people actually think they can use Signal or some other 'security app' on a device that is fundamentally compromised already. Sure, your messages are encrypted, but they (whoever they are) have the private keys (both sender and receiver) because the smart phones you are using are compromised by them. It's really simple. So next time you read a news story about criminals who were using some supposedly secure app to commit crimes, but got caught anyway... keep this in mind.

b8 2y ago
Yep, Cellebrite is popular among LE and my phone (a new Pixel) is able is be extracted. Even if I install a privacy OS such as GrapheneOS, I don't think it would help. The Librem phone looks nice, but it costs a lot and the camera/specs are bad.
- seethishat 2y ago
  Exactly. Just don't commit crimes and don't use a phone/computer to commit crimes thinking you will get away with it. It doesn't work, they know who you are and what you did. It's really simple.
  - ziddoap 2y ago
    Great to learn that across all of history, only criminals are subject to searches and there has never been corruption in law enforcement.
  - robertwebb 2y ago
    [dead]
  - rexpop 2y ago
    > Just don't commit crimes. This is a really, really ignorant imperative. First of all, the criminalization of poverty and structural injustice, generally, make technically criminal activity inevitable in some communities, but I recognize that what you actually mean is "don't commit criminal acts of protest" which is still ludicrously ignorant—and cruel! Civil disobedience, by definition, involves the deliberate violation of a law. It is, nevertheless, our duty to perform when laws or systems perpetuate severe injustices, democratic failures, or lack legitimacy. As John F. Kennedy famously put it, "Those who make [legal] revolution impossible will make [criminal] revolution inevitable." This is economics.

fortyseven 2y ago

If I'm going to be involved in something like this I'm sure as hell not bringing my daily driver phone. Get serious. Grab a burner, go in expecting it to get discarded or to fall into unfriendly hands.

throwaway_43210 2y ago

> We recommend Signal, which was built from the ground up for personal security. WhatsApp has E2EE for all messages too, I don't understand why people think of Signal as a bullet-proof instant messaging solution for privacy, especially when 1. Requires Phone Number in order to use (I'm sure fanboys have explanations for that) 2. It is centralized 3. Uses APNs or GCM for push notifications

Ylpertnodi 2y ago
For me, the difference choosing between whatsapp and signal has more to do the who is in, and behind, the respective companies. Liar Zuckerberg lost by fvcking mile.

unethical_ban 2y ago

I wonder how many of the posts here saying "this is all useless" actually go to protest, or in their heart support those who do. Can the full might of the fbi and nsa own you of they want? Likely. The threat model here is local PD, and the goal is to make their job of incriminating you in any way, harder. Meaning making it harder to get into your phone. Harder to passively intercept data like sms and phone calls. Harder to get days by asking the big companies like google.

unethical_ban 2y ago
*harder to get data by asking

pithanyChan 2y ago

> Intrusion Protection Any ways to check the current updated official images against what is installed on the phone or notebook via a oneliner or an app? Like in a couple of minutes like a virus scan. Burning the hardware is one thing but having confirmation would be nice.

_DeadFred_ 2y ago

Not infosec but when washing off pepper spray/tear gas, don't let it run down 'sensitive' areas.

rpgwaiter 2y ago

Good article, although it stresses the need to have trusted friends to protest with but doesn’t explain how to find, make, keep these friends. To be fair, I’ve been trying to figure that part put for like 10 years but it would be cool to have advice in that area as well. Keep up the good fight!

samothrace 2y ago
I think the recommendation is to go to events relevant to your interests, actively contribute, and speak to people.

bitbasher 2y ago

All of their advice is pretty moot because they are saying you should have your phone with you and that alone is going to hit cell towers and put you at the location of the action.

Xen9 2y ago
Not so if you EMI tape the GOS phone case, disable USB-C except for charging, use second profile to encrypt your actual data so you can attest before decrypting, and keep it turned off and in aeroplane mode when not in use. See my comments.
- bitbasher 2y ago
  Your phone going “dark” during an action is in itself a signal that you are involved in the action. Especially when it deviates from your phones normal activity patterns. It would make more sense to leave your phone on and at home. However, you can’t use any of the tools the articles lists if you have no phone.
  - Xen9 2y ago
    That's why you keep it offline at all times! And for calls use something dumb & leave that at home.

treebeard901 2y ago

As someone who has decades of tech experience and have been the target of various Government agencies for many years... I have a few things to add: Most devices have some kind of GPS or positioning system. Phones in particular still communicate certain information to cell towers and E911 even if there is no SIM installed. Wrapping your phone in aluminum foil does not block all the signals as many have been lead to believe. It is not certain, especially with 5G what faraday bags can work. Your best bet is a phone where you can remove the battery. Even this could leave residual power in the device. One of the most non technical aspects of Government surveillance, especially in the United States, is that their ability to request data depends on each specific provider. Usually, law enforcement has long standing relationships with all these companies and the higher up you go in the U.S. Govt, you get more of this. After all, there are a million ways the Govt can keep a device off the market if they do not comply with whatever the Government wants. Maybe most importantly, parallel construction is often used here. For example, law enforcement will only follow the rules and get a warrant if they intend to present a case in court. Often, they just want information and if they want to use it they will find a way to parallel construct its source. Do not rely on your constitutional protections or anything else. In many cases it is simply not a factor for them. Everything about your phone comes back to the sim card. It is extremely difficult to get a working SIM without some form of ID. Most SIM cards are traceable this way, especially if you purchase them in the U.S. Most services require a form of authentication as well, often a phone number which requires the SIM belong to someone, or an email address, which very often requires a phone number to create. Used burner phones are your best bet. Any cloud service connection your phone initiates is able to be intercepted and the Govt can deploy a form of a man in the middle decryption attack with the help of your cell provider. This is not used as often but unless everything you have uses certificate pinning, and often this isn't the case, it is very easy to man in the middle your end to end traffic and decrypt it. Applications also leak like crazy to various APIs and other things they use. Connections can be downgraded to HTTP and all other forms of tricks to monitor you are used. For example, if you are using an end to end encrypted messaging app, and you have the content of those messages going to the apple or google notification system, you do not have end to end encrypted messaging. This is why Signal disables the content in the notification by default. There are other attack surfaces here as well. Keyboard autocomplete is one as it uses remote services. If LE knows you are using something like Signal, and they can see you created a new contact on your phone to message them, they already know who you are talking to you, and if your phone keyboard is using autocomplete or grammar correct, they could potentially get what both sides are writing to each other without actually breaking the encryption. There are other methods as well. iPhones have the ability to use a form of Remote Desktop that can be accessed over the cell connection. So as you are using the app, your screen can be monitored, thus defeating any encryption security you think you have. If Law enforcement knows you have cloud accounts, say with iCloud or Google Docs, and you are working on something in there, you can be sure that it is possible for your work to be viewed as you are working on it. This has a ton of implications for people just doing normal non activist work as well. Maybe you're working on your own legal case and they can literally just watch you build a legal defense and then plan accordingly. It really is endless what they can do. If the Govt is interested in you, most cities are full surveillance cities now. You can have no phone, no RFID anything, change your routes, change your appearance and you will still be found. There are rare exceptions to this but for the most part assume you cannot move around a city without being constantly monitored. Even if you only have a pair of bluetooth headphones, there are all kinds of devices collecting broadcast data, and these can be correlated with device lists uploaded when you pair a device. This is just a short list of things I've experienced personally... There is so much more. Any large formal resistance basically cannot happen without the Govt knowing about it. EDIT: Sorry for the wall of text